Fortigate IPS udp_flood L4 anomalies - VID285212775 - deep understanding of measurement and raw even

Hello,

We are trying to adjust the threshold for the Fortigate DOS IPv4 L4 anomalies rule because it triggers too many incidents on our FortiSIEM.

The issue is that it is hard to know how far the threshold (5000 pps in our case) is overtaken.

The raw log, as sent by the FW to the FortiSIEM is the following:

<185>logver=702101706 timestamp=1741353017 devname="*redacted*" devid="*redacted*" vd="root" date=2025-03-07 time=13:10:17 eventtime=1741371017400546868 tz="-0500" logid="0720018432" type="utm" subtype="anomaly" eventtype="anomaly" level="alert" severity="critical" srcip=*redacted* srccountry="Reserved" dstip=*redacted* dstcountry="Reserved" srcintf="VLAN35" srcintfrole="lan" sessionid=0 action="detected" proto=17 service="udp-53" count=13 attack="udp_dst_session" srcport=57032 dstport=53 attackid=285212775 policyid=3 policytype="DoS-policy" ref="http://www.fortinet.com/ids/VID285212775" msg="anomaly: udp_dst_session, 5001 > threshold 5000, repeats 13 times" crscore=50 craction=4096 crlevel="critical"

We see that threshold was crossed (5001, which is exactly defined threshold+1, certaninly not 5001 for real) but not by how many pps ?

The fortiguard link http://www.fortinet.com/ids/VID285212775 is dead for weeks so we have little info on how it is implemented. The FTG doc here https://docs.fortinet.com/document/fortigate/7.2.10/administration-guide/771644/dos-policy is not clear on how exactly the alert is triggered.

Questions:

1. On the FTG side how are the pps measured (sampled) ? Is the number of packets cumulated every minute then divided by 60 to get packets par second? Or is this calculation done every 15 minutes?
2. The 'repeat 13 times' : does it mean the 5000pps threshold was crossed 13 times? If yes, over which period of time?

Thanks for your help

Brgds/Jerome